- Freeradius-Users - lists.freeradius.org

Generating a Microsoft compatible CSR for FreeRADIUS
by Sallee, Stephen (Jake) 21 Jan '11

21 Jan '11

I need help generating a Microsoft compatible CSR for my FR server that I can get signed by a public CA. The documentation mentions special OID's that need to be present for MS machines to accept the cert, but I can't find WHAT those OID's are so I can make sure I include them in the CSR. I know the docs also say that it is not best practices to use a publicly signed cart because ANYONE can auth against the server, however since I am in a position where almost all of the computers will NOT be managed by our staff (they are student workstations) a public cert seems perfect. If anyone has another route that will allow me to auth windows clients without having to manually install certs and/or manually configuring the wireless adapters I would be very grateful to hear your suggestions. THANKS! Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

8 15

Radius should assign based on the connected SSID/VLAN different Authentications rules ...
by Philipp Hanselmann 21 Jan '11

21 Jan '11

Hi, We have the following setup: Wireless Client (authentication with EAP-TTLS/PAP) | | SSID (wlan) \/ WLAN Access Point (NAS with EAP-PEAP, Cihpher TKIP ) -> SSID: wlan connected to VLAN 111 | | \/ Radius Server (Check if user in member of the LDAP group company-users) If yes, check his credentials with the LDAP Server. | | \/ LDAP Server (for Authentication) Up to know this is working. Now the idea is that the same AP is managing a second SSID called wlan-public. This SSID should be connection too a separate VLAN (ID 113). Mostly this SSID should be used by our guests for basic Internet access (No access to our company network) To release that the RADIUS server must be able to detect the connected SSID. Based on that different users groups are allowed. We noticed that the AP is informing the Radius about the connected SSID (see below), but we couldn't figure out the right way to detect that the information or too use it. We tried to detect the value Cisco-AVPair with /etc/freeradius/users <snip> # wlan-public - Connected to guest vlan - four our guest. # (Access with user guest, password guest) DEFAULT Cisco-AVPair =~ "ssid=wlan-public" Reply-Message = "Your SSID:qwlan-public", Fall-Through = Yes # debug DEFAULT Reply-Message = "Cisco-AVPair: %{Cisco-AVPair[*]}", Fall-Through = Yes # qwlan - Connected to company vlan - for our employees - membership company-users is needed # (Access with every LDAP account, No access with the user guest) DEFAULT Cisco-AVPair =~ "ssid=wlan" Reply-Message = "Your SSID:wlan", Fall-Through = Yes DEFAULT Ldap-Group == "company-users" Reply-Message = "Welcome to the Wireless Network wlan" <\snip> but without success. Even based on the debug output it looks like that the value %{Cisco-AVPair[*]} is empty? Help would be appreciated. Regards, Philipp Hanselmann -- * freeradius -X | grep Cisco [files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair: Reply-Message = "Cisco-AVPair: " [files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair: Reply-Message = "Cisco-AVPair: " [files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair: Reply-Message = "Cisco-AVPair: " Cisco-AVPair = "ssid=wlan-public" Cisco-AVPair = "vlan-id=113" Cisco-AVPair = "nas-location=unspecified" Cisco-AVPair = "connect-progress=Call Up" * freeradius -X | grep Cisco <snip> ++[exec] returns noop Sending Access-Accept of id 39 to 192.168.110.210 port 1645 MS-MPPE-Recv-Key = 0xdcf7bf00aa1600ac7ba7032d9exxxxxcd5xxxxxxxxxxx115738 MS-MPPE-Send-Key = 0x8cf29e70b657866e446fb2a8c9xxxxxxxxxxxxxxxxxxxc EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "phanselmann" Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Accounting-Request packet from host 192.168.110.21 port 1646, id=81, length=230 Acct-Session-Id = "00000312" Called-Station-Id = "001a.e35f.42e1" Calling-Station-Id = "0090.4b9a.6ac4" Cisco-AVPair = "ssid=wlan-public" Cisco-AVPair = "vlan-id=113" Cisco-AVPair = "nas-location=unspecified" User-Name = "phanselmann" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 NAS-Port = 392 NAS-Port-Id = "392" Service-Type = Framed-User NAS-IP-Address = 192.168.110.21 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 392,Client-IP-Address = 192.168.110.21,NAS-IP-Address = 192.168.110.21,Acct-Session-Id = "00000312",User-Name = "phanse"' [acct_unique] Acct-Unique-Session-ID = "8eebd433aaed7864". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "p </snip> <snip> -- Philipp Hanselmann System Administrator Qnamic AG Fabrikstrasse 10 CH-4614 Hägendorf Switzerland Phone: +41 62 209 70 40 Fax: +41 62 209 70 44 philipp.hanselmann(a)qnamic.com www.qnamic.com

2 1

freeradius 2.1.10 & postgresql & custom attributes
by slash13 21 Jan '11

21 Jan '11

hello freeradius users I managed to install freeradius together with a working postgresql database. Does anybody know what would be the easiest way to add custom accounting attributes both in configuration and database? So far I couldnt find any fast solution! looking forward hearing from you. cheers Alex -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius-2-1-10-postgresql-custom… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

Re: FR 2.1.10 + dialup_admin Could not connect to SQL database
by Jim Rice 21 Jan '11

21 Jan '11

Yes, I know. I was merely illustrating that I was able to configure freeradius to use sql. I am trying to add dialup_admin into the mix... As I mentioned, dialup_admin Could not connect to SQL database when trying to access any of the menu choices. I figured it out. I wasn't even able to connect using mysql from the command line for the user dialup_admin. It turned out to be a GRANT USAGE issue with dialup_admin@localhost. (It did not have the IDENTIFIED BY PASSWORD ...). Working now. (But I need to turn off the debug stuff.) Jim

1 0

FR 2.1.10 + dialup_admin Could not connect to SQL database
by jmrice 21 Jan '11

21 Jan '11

Followed the README and HOW TO as best I could. I think I am finally close. radiusd -X shows it connecting to sql when I tried radtest, but dialup_admin cannot connect. I have sql_debug : true and even set sqltrace = yes but it does not produce an sqltrace.sql file. There is also nothing in mysqld.log. I have been through quite a bit getting this far, nd feel like I have just overlooked something simple. Can anyone help point me in the right direction? Thanks, Jim -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-10-dialup-admin-Could-not-co… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: Freeradius-Users Digest, Vol 69, Issue 67
by Samuel 20 Jan '11

20 Jan '11

Thanks, Thorsten Fischer. That was the solution. > Today's Topics: > > 1. Re: Logging Authentication Rejects (Alan DeKok) > 2. Freeradius2 + Daloradius (Samuel) > 3. Freeradius2 + Daloradius (Samuel) > 4. Re: Freeradius2 + Daloradius (Thorsten Fischer) > Message: 2 > Date: Thu, 20 Jan 2011 12:58:20 +0000 > From: Samuel<abeka(a)greatiam.com> > Subject: Freeradius2 + Daloradius > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4D38316C.6080504(a)greatiam.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Please can someone shed light on what I must have done wrong. > I have Freeradius 2 installed on Centos 5.5 with Mysql 5 and added > Daloradius 0.9-8 as a frontend. > All seem OK except that I get an error with the radius logs. Daloradius > claims /var/log/radius/radius.log does not exist but it is there. > Dolaradius was looking originally for /var/log/freeradius/radius.log. I > have made changes in the ~/library/exten-radius_log.php file to look for > /var/log/radius/radius.log yet no success. Has anyone got a solution > please ? > > Thanks > > Samuel > > > > ------------------------------ > > Message: 3 > Date: Thu, 20 Jan 2011 13:00:24 +0000 > From: Samuel<abeka(a)greatiam.com> > Subject: Freeradius2 + Daloradius > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4D3831E8.8000007(a)greatiam.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Pardon me if this has been addressed on this forum. > > Please can someone shed light on what I must have done wrong . I have > Freeradius 2 installed on Centos 5.5 with Mysql 5 and added Daloradius > 0.9-8 as a frontend. All seem OK except that I get an error with the > radius logs. Daloradius claims /var/log/radius/radius.log does not exist > but it is there. Dolaradius was looking originally for > /var/log/freeradius/radius.log. I have made changes in the > ~/library/exten-radius_log.php file to look for > /var/log/radius/radius.log yet no success. Has anyone got a solution > please ? > > Thanks > > Samuel > > > > ------------------------------ > > Message: 4 > Date: Thu, 20 Jan 2011 13:37:58 +0000 > From: Thorsten Fischer<thorsten(a)net.t-labs.tu-berlin.de> > Subject: Re: Freeradius2 + Daloradius > To: freeradius-users<freeradius-users(a)lists.freeradius.org> > Message-ID:<1295530538-sup-6785(a)mail.froschi.org> > Content-Type: text/plain; charset=UTF-8 > > Excerpts from Samuel's message of Thu Jan 20 13:00:24 +0000 2011: >> [...] >> All seem OK except that I get an error with the radius logs. Daloradius >> claims /var/log/radius/radius.log does not exist but it is there. > The user you are running your web application with does not have access > permissions to read the file. > > > Cheers, > > t >

1 0

Re: force_check_config - how to use?
by William Bulley 20 Jan '11

20 Jan '11

According to Alan DeKok <aland(a)deployingradius.com> on Thu, 01/20/11 at 09:23: > > How does the server now that some random module will expand some > random string in the configuration file? > > FYI, it's possible to have "%{...}" in a string which *isn't* > dynamically expanded. I think we are having a misunderstanding here. I don't disagree with what you say above. > > Proper _syntax_ checking > > would have caught this gnarly typo. Discovering the actual problem was > > made more difficult by admins assuming that -XC was more than the above > > described superficial configuration test. Thank you for your repsonses. > > The only way to test run-time expansions is by running packets through > the server. This is true - but this is not my current issue. > If you have a *patch* which helps, great. Until then... You said yourself to not look at the source code. Patches are unlikely in that atmosphere. My point: _syntax_ checking for valid _syntax_ at a time _other_ than run time _is_ _possible_ without having to go the extra mile of semantic checking, as in, variable expansion. I am not talking about variable expansion, since that is only possible by running packets through the server (at run time). Since I am not allowed to inspect the source code, I would not have been able to discover the following comments relevant to this thread: conffile.c - Yep I should learn to use lex & yacc, or at least write a decent parser. conffile.c - FIXME: Add support for ${foo:-bar}, like in xlat.c conffile.c - The parser is getting to be evil. conffile.c - I really really really hate this file. conffile.c - More sanity checking. This is getting to be a horrible hack. conffile.c - yuck... xlat.c - Did I mention that this parser is garbage? If my employer would permit, and if you would allow me to look at the source, I would be happy to supply a patch. Neither of these are likely to happen in any event. This thread was created to shed some light on the issue. I do appreciate your comments. Thanks again. :-) Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

Re: force_check_config - how to use?
by William Bulley 20 Jan '11

20 Jan '11

According to Alan DeKok <aland(a)deployingradius.com> on Thu, 01/20/11 at 04:09: > > > > This was changed by an adminstrator to --username=%{mschap:User-Name:-None} > > except that the leading left brace ("{") was omitted... :-( > > That's a run-time expansion. Checking the config won't help. I got that. See below. > > My question: is there any way to parse and check the "value" of the > > ntlm_auth variable in the modules/mschap file for valid syntax? > > No. It can only be checked by running the server. You are partly right. See below. > > It doesn't seem that this ntlm_auth variable was expanded when the config > > file was read. > > It's not. It's expanded at *run time*, when the server receives a packet. True. The variable expansion can only occur at run time. > No. "-XC" succeeding means that the configuration is *superficially* > OK. It's not a substitute for doing functional tests. Clearly. :-) > The ntlm_auth line is expanded at run time, using data taken from the > packet. That is the *only* time that the server can discover an error. > It can't discover the error when it loads the configuration, because > the server core doesn't know which strings should be expanded, and what > data should be put in the expansion. This it true: the ntlm_auth line is expanded at run time. My question in this thread is for the consideration of more throrough _syntax_ checking - without expansion - during the -XC process. Proper _syntax_ checking would have caught this gnarly typo. Discovering the actual problem was made more difficult by admins assuming that -XC was more than the above described superficial configuration test. Thank you for your repsonses. Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

ETA for 2.1.11?
by Craig Campbell 20 Jan '11

20 Jan '11

Just wondering when 2.1.11 might be released? I am seeing an issue in 2.1.10 very similar to "FR 2.1.9 Frequent SegFault, didn't happen with FR 2.1.8" (http://freeradius.1045715.n5.nabble.com/FR-2-1-9-Frequent-SegFault-didn-t-h…) I am hoping that the cause might have already been addressed and vanish in 2.1.11. Thanks for all the hard work on freeradius. -craig __________ Information from ESET Smart Security, version of virus signature database 5803 (20110120) __________ The message was checked by ESET Smart Security. http://www.eset.com

2 1

Freeradius2 + Daloradius
by Samuel 20 Jan '11

20 Jan '11

Pardon me if this has been addressed on this forum. Please can someone shed light on what I must have done wrong . I have Freeradius 2 installed on Centos 5.5 with Mysql 5 and added Daloradius 0.9-8 as a frontend. All seem OK except that I get an error with the radius logs. Daloradius claims /var/log/radius/radius.log does not exist but it is there. Dolaradius was looking originally for /var/log/freeradius/radius.log. I have made changes in the ~/library/exten-radius_log.php file to look for /var/log/radius/radius.log yet no success. Has anyone got a solution please ? Thanks Samuel

2 1